[SECURITY] [DLA 1249-2] smarty3 regression update

2018-02-01T09:13:07
ID DEBIAN:DLA-1249-2:E4D67
Type debian
Reporter Debian
Modified 2018-02-01T09:13:07

Description

Package : smarty3 Version : 3.1.10-2+deb7u3 CVE ID : CVE-2017-1000480 Debian Bug : #886460

It was previously discovered that there was a code-injection vulnerability in smarty3, a PHP template engine. A via specially-crafted filename in comments could result in arbitrary code execution.

However, the fix in 3.1.10-2+deb7u2 was incorrect. For Debian 7 "Wheezy", this regression has been addressed in smarty3 version 3.1.10-2+deb7u3.

We recommend that you upgrade your smarty3 packages.

Regards,


  ,''`.
 : :'  :     Chris Lamb
 `. `'`      lamby@debian.org / chris-lamb.co.uk
   `-